Re: Audit Failures/READ_CONTROL SYNCHRONIZE

From: Binesh Bannerjee (binesh-dated-1017922749.387722@hex21.com)
Date: 03/28/02 

From: Binesh Bannerjee <binesh-dated-1017922749.387722@hex21.com>
Date: 28 Mar 2002 12:20:20 GMT
To: Binesh Bannerjee <binesh@hex21.com>, Eric Fitzgerald <ericf@online.microsoft.com>

Eric Fitzgerald [MSFT] <ericf@online.microsoft.com> wrote:
: The 560 object access event does not record what actions were performed on
: the file, it records what accesses were requested to the file. It does not
: mean that the program performed those operations on the file or even
: intended to do so.

: If you're using Windows 2000 then you're going to see a lot of yucky events
: like this. Access failures often occur normally, Explorer in particular
: often tries to open files with maximum privilege (which will often fail),
: and then use the failure as a UI cue- it will display the file differently.
: For instance, if you don't have Full Control on a file, Explorer will notice
: and disable parts of the security dialog. Unfortunately if you've enabled
: failure auditing then you will get an event.

: Lastly, "Read Control" and "Synchronize" are two of the standard rights-
: they are requested with almost every access. Read Control is the ability to
: read the security descriptor on the file. Synchronize is the ability to
: have the operating system notify the program of changes to the file.

: For Windows XP and Windows .NET Server we've added a new event, 567, which
: is logged when an operation is actually performed on a file. This will not
: be back-ported to Windows 2000.

Thanks, this was very helpful!

Is there a way to not log specific Event ID's? Then I just wouldn't log Event
ID 560, and I could simply open up the Security Log from time to time, and
as long as there are no lock symbols in the log, then I know everything
is OK... ? Or, am I trying to use auditing for something it was not intended?

The other thing I was hoping to find was rogue programs that seem to insist
on writing to c:\winnt... How would I go about making the C drive be fully
read only? (I've already created a D drive, changed the TEMP and TMP
environments to D:\TEMP and changed the print spool folder to
D:\printspool...

Anything else you might recommend?

Thanks,
Binesh Bannerjee

: --
: Eric Fitzgerald
: Program Manager, Windows Auditing and Intrusion Detection
: Microsoft Corporation

Relevant Pages

  • Re: Audit Failures/READ_CONTROL SYNCHRONIZE
    ... am I trying to use auditing for something it was not ... >: If you're using Windows 2000 then you're going to see a lot of yucky events>: like this. ... Access failures often occur normally, Explorer in particular>: often tries to open files with maximum privilege,>: and then use the failure as a UI cue- it will display the file differently. ... >: For instance, if you don't have Full Control on a file, Explorer will notice>: and disable parts of the security dialog. ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Security settings
    ... to enable the system's own object access auditing feature for any ... suspected file and registry locations that might be accessed by the ... you can then modify the security settings on only those resources to ... > for object access (enabling auditing for failure should be sufficient, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: 2003 fileserver glitch
    ... Jeffrey Randow (Windows Networking & Smart Display MVP) ... you would need to turn on auditing. ... >Click properties of the folder you wish to audit. ... Chose Security, Advanced ...
    (microsoft.public.windows.server.general)
  • Re: krbtgt failure logs
    ... This is a very small bug in Windows 2000. ... this error when its TGT expires; you don't see any problems because after ... the failure we renew the TGT and then re-try the operation. ... >> I'll miss a real security issue. ...
    (microsoft.public.security)
  • Re: How do I tell which user deleted a file?
    ... Windows security is basically the ... Afterwards you can find all auditing info in the "Security" event log. ... Close the above and then use Windows Explorer to find the folder or ...
    (microsoft.public.windows.server.security)